Wazuh cheatsheet

# --- Agent status ---
/var/ossec/bin/agent_control -l               # list all agents
/var/ossec/bin/agent_control -i <id>          # agent detail
/var/ossec/bin/agent_control -R <id>          # restart agent remotely

# --- Service control ---
/var/ossec/bin/wazuh-control start|stop|restart|status|reload

# --- Rule/decoder testing ---
/var/ossec/bin/wazuh-logtest                  # interactive log tester (Wazuh 4.2+)
/var/ossec/bin/wazuh-logtest -v               # verbose (show all decoders tried)
# Legacy name: ossec-logtest (symlinked in some installs)
echo "Apr 10 10:00:00 host sshd[1234]: Failed password for root from 10.0.0.1 port 22 ssh2" \
  | /var/ossec/bin/wazuh-logtest

# --- Real-time alert tailing ---
tail -f /var/ossec/logs/alerts/alerts.log
tail -f /var/ossec/logs/alerts/alerts.json

# --- Config validation ---
/var/ossec/bin/wazuh-analysisd -t             # test ossec.conf syntax

# --- Groups ---
/var/ossec/bin/agent_groups -l                # list groups
/var/ossec/bin/agent_groups -s -i <id>        # show agent group membership

# --- FIM manual scan trigger ---
/var/ossec/bin/agent_control -a -u <id>       # run syscheck on agent

# --- API token (quick) ---
TOKEN=$(curl -su wazuh:wazuh -k -X POST \
  "https://localhost:55000/security/user/authenticate?raw=true")

# Import GPG key
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH \
  | gpg --no-default-keyring \
    --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg \
    --import
chmod 644 /usr/share/keyrings/wazuh.gpg

# Add repository
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] \
  https://packages.wazuh.com/4.x/apt/ stable main" \
  | tee /etc/apt/sources.list.d/wazuh.list

# Install with manager address pre-set
apt-get update
WAZUH_MANAGER="10.0.0.1" apt-get install -y wazuh-agent

# Enable and start
systemctl daemon-reload
systemctl enable --now wazuh-agent

# Add repo
cat > /etc/yum.repos.d/wazuh.repo << 'EOF'
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
EOF

# Install
WAZUH_MANAGER="10.0.0.1" yum install -y wazuh-agent

systemctl daemon-reload
systemctl enable --now wazuh-agent

# Download installer
Invoke-WebRequest `
  -Uri "https://packages.wazuh.com/4.x/windows/wazuh-agent-4.x.x-1.msi" `
  -OutFile "$env:TEMP\wazuh-agent.msi"

# Silent install with manager and group
msiexec /i "$env:TEMP\wazuh-agent.msi" /q `
  WAZUH_MANAGER="10.0.0.1" `
  WAZUH_AGENT_GROUP="windows-servers" `
  WAZUH_REGISTRATION_PASSWORD="MySecret"

# Start service
NET START WazuhSvc

# Verify
Get-Service WazuhSvc

# Download pkg
curl -so wazuh-agent.pkg \
  "https://packages.wazuh.com/4.x/macos/wazuh-agent-4.x.x-1.pkg"

# Pre-configure manager
echo "WAZUH_MANAGER='10.0.0.1'" > /tmp/wazuh_envs
echo "WAZUH_AGENT_GROUP='macos'" >> /tmp/wazuh_envs

# Install
installer -pkg wazuh-agent.pkg -target /

# Start
/Library/Ossec/bin/wazuh-control start

docker run -d --name wazuh-agent \
  --restart unless-stopped \
  -e WAZUH_MANAGER="10.0.0.1" \
  -e WAZUH_AGENT_GROUP="docker-hosts" \
  -e WAZUH_REGISTRATION_PASSWORD="MySecret" \
  -v /var/log:/var/log:ro \
  -v /etc:/etc:ro \
  --pid=host \
  --network=host \
  --privileged \
  wazuh/wazuh/wazuh-agent:latest

# On agent: register with manager enrollment service (port 1515)
/var/ossec/bin/agent-auth \
  -m 10.0.0.1 \
  -p 1515 \
  -G linux-servers \
  -P "EnrollmentPassword"

# Verify key was issued
cat /var/ossec/etc/client.keys

# Create group
/var/ossec/bin/agent_groups -a -g linux-servers -q
/var/ossec/bin/agent_groups -a -g windows-servers -q
/var/ossec/bin/agent_groups -a -g dmz -q

# List all groups
/var/ossec/bin/agent_groups -l

# Assign agent to group
/var/ossec/bin/agent_groups -a -i 003 -g linux-servers -q

# Show group members
/var/ossec/bin/agent_groups -s -g linux-servers

# Remove agent from group
/var/ossec/bin/agent_groups -r -i 003 -g linux-servers -q

# API: create group
curl -k -X POST "https://localhost:55000/groups" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"group_id":"linux-servers"}'

# API: assign agent to group
curl -k -X PUT \
  "https://localhost:55000/agents/003/group/linux-servers" \
  -H "Authorization: Bearer $TOKEN"

<!-- /var/ossec/etc/shared/linux-servers/agent.conf -->
<!-- Pushed automatically to all agents in the group -->
<agent_config>

  <!-- Extra log collection for this group -->
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/auth.log</location>
  </localfile>

  <!-- Group-specific FIM paths -->
  <syscheck>
    <directories realtime="yes" whodata="yes">/opt/app</directories>
    <directories check_all="yes" report_changes="yes">/etc/nginx</directories>
  </syscheck>

  <!-- Group-specific SCA policy -->
  <sca>
    <policies>
      <policy>etc/shared/cis_debian_linux_rcl.yml</policy>
    </policies>
  </sca>

</agent_config>

<!-- /var/ossec/etc/ossec.conf (on agent) -->
<ossec_config>
  <client>
    <server>
      <address>10.0.0.1</address>
      <port>1514</port>
      <protocol>tcp</protocol>
    </server>
    <config-profile>ubuntu, ubuntu22</config-profile>
    <notify_time>10</notify_time>
    <time-reconnect>60</time-reconnect>
    <auto_restart>yes</auto_restart>
    <enrollment>
      <enabled>yes</enabled>
      <manager_address>10.0.0.1</manager_address>
      <port>1515</port>
    </enrollment>
  </client>

  <!-- Windows event channels -->
  <localfile>
    <log_format>eventchannel</log_format>
    <location>Security</location>
    <query>Event/System[EventID != 4688]</query>
  </localfile>
  <localfile>
    <log_format>eventchannel</log_format>
    <location>Microsoft-Windows-Sysmon/Operational</location>
  </localfile>
  <localfile>
    <log_format>eventchannel</log_format>
    <location>Microsoft-Windows-PowerShell/Operational</location>
  </localfile>
</ossec_config>

<!-- Single technique -->
<rule id="120001" level="13">
  <if_group>syslog</if_group>
  <match>su: FAILED</match>
  <description>Failed su command</description>
  <mitre>
    <id>T1548.003</id>
  </mitre>
</rule>

<!-- Multiple techniques in one rule -->
<rule id="120002" level="14">
  <if_group>windows</if_group>
  <field name="win.eventdata.commandLine" type="pcre2">
    (?i)(net\s+user|net\s+localgroup|dsquery|Get-ADUser)
  </field>
  <description>Active Directory enumeration detected</description>
  <mitre>
    <id>T1087.002</id>   <!-- Account Discovery: Domain Account -->
    <id>T1069.002</id>   <!-- Permission Groups Discovery: Domain Groups -->
  </mitre>
</rule>

# Kibana/OpenSearch Dashboards - filter by technique
rule.mitre.id: "T1059.001"

# All credential access techniques
rule.mitre.tactic: "Credential Access"

# Top MITRE techniques (last 24h)
# Dashboard > MITRE ATT&CK > Framework tab > filter timerange

# API: get alerts by MITRE technique
curl -k -H "Authorization: Bearer $TOKEN" \
  "https://localhost:55000/alerts?q=rule.mitre.id=T1059.001&limit=100&pretty=true"

<!-- In ossec.conf or agent.conf -->
<syscheck>

  <!-- Scan interval (seconds); default 43200 = 12h -->
  <frequency>43200</frequency>

  <!-- Scheduled scan at specific time -->
  <scan_time>02:00</scan_time>
  <scan_day>saturday</scan_day>

  <!-- Disable at startup -->
  <scan_on_start>yes</scan_on_start>

  <!-- ── Realtime monitoring (inotify/FSEvents) ── -->
  <directories realtime="yes">/var/www/html</directories>

  <!-- ── Whodata: who changed the file (audit subsystem) ── -->
  <directories whodata="yes" realtime="yes">/etc</directories>

  <!-- ── Full options ── -->
  <directories
    check_all="yes"
    report_changes="yes"
    realtime="yes"
    whodata="yes"
    recursion_level="3"
    tags="critical_config"
  >/etc/ssh,/etc/pam.d,/etc/sudoers.d</directories>

  <!-- ── Windows: critical system paths ── -->
  <directories check_all="yes" realtime="yes">%WINDIR%\System32\drivers</directories>
  <directories check_all="yes" realtime="yes">%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup</directories>

  <!-- ── Ignore patterns ── -->
  <ignore>/etc/mtab</ignore>
  <ignore>/etc/mnttab</ignore>
  <ignore type="sregex">\.log$|\.tmp$|\.swp$</ignore>

  <!-- ── Nodiff: suppress content diff for sensitive files ── -->
  <nodiff>/etc/ssl/private</nodiff>
  <nodiff type="sregex">\.key$|\.pem$|id_rsa</nodiff>

  <!-- ── Windows Registry monitoring ── -->
  <windows_registry>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run</windows_registry>
  <windows_registry arch="both">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services</windows_registry>

  <!-- ── Registry ignore ── -->
  <registry_ignore>HKEY_LOCAL_MACHINE\Security\Policy\Secrets</registry_ignore>

  <!-- ── Restrict: only watch specific file types ── -->
  <directories restrict="\.conf$|\.cfg$|\.ini$">/opt/app/config</directories>

</syscheck>

<!-- In ossec.conf or agent.conf -->
<sca>
  <enabled>yes</enabled>
  <!-- Scan interval -->
  <interval>12h</interval>
  <scan_on_start>yes</scan_on_start>
  <!-- Skip failed policies -->
  <skip_nfs>yes</skip_nfs>
  <policies>
    <!-- Enable specific built-in policies -->
    <policy>etc/shared/cis_debian_linux_rcl.yml</policy>
    <policy>etc/shared/cis_rhel9_linux_rcl.yml</policy>
    <!-- Custom policy -->
    <policy>etc/shared/custom_hardening.yml</policy>
    <!-- Disable a policy -->
    <policy enabled="no">etc/shared/web_vulnerabilities.yml</policy>
  </policies>
</sca>

# Get SCA summary for all agents
curl -k -H "Authorization: Bearer $TOKEN" \
  "https://localhost:55000/sca?pretty=true"

# Get SCA results for specific agent
curl -k -H "Authorization: Bearer $TOKEN" \
  "https://localhost:55000/sca/003?pretty=true"

# Get failed checks for an agent
curl -k -H "Authorization: Bearer $TOKEN" \
  "https://localhost:55000/sca/003/checks/custom_linux_hardening?result=failed&pretty=true"

<!-- In /var/ossec/etc/ossec.conf on manager -->
<vulnerability-detection>
  <enabled>yes</enabled>
  <!-- Index vulnerability data to Wazuh Indexer -->
  <index-status>yes</index-status>
  <!-- Feed update interval (min 60m) -->
  <feed-update-interval>12h</feed-update-interval>
</vulnerability-detection>

<!-- Syscollector: must be enabled on agents to collect inventory -->
<wodle name="syscollector">
  <disabled>no</disabled>
  <interval>1h</interval>
  <scan_on_start>yes</scan_on_start>
  <packages>yes</packages>
  <os>yes</os>
  <processes>yes</processes>
  <ports all="no">yes</ports>
  <network>yes</network>
</wodle>

# Get all vulnerabilities for an agent
curl -k -H "Authorization: Bearer $TOKEN" \
  "https://localhost:55000/vulnerability/003?pretty=true"

# Filter by severity
curl -k -H "Authorization: Bearer $TOKEN" \
  "https://localhost:55000/vulnerability/003?severity=critical&pretty=true"

# Get CVE details
curl -k -H "Authorization: Bearer $TOKEN" \
  "https://localhost:55000/vulnerability/003?cve=CVE-2021-44228&pretty=true"

# Get all agents with critical vulns
curl -k -H "Authorization: Bearer $TOKEN" \
  "https://localhost:55000/vulnerability?severity=critical&limit=500&pretty=true"

# Dashboard KQL - find critical vulns
# vulnerability.severity: "critical" AND vulnerability.status: "active"

vulnerability.cve           - CVE identifier
vulnerability.severity      - critical/high/medium/low
vulnerability.cvss2_score   - CVSS v2 score
vulnerability.cvss3_score   - CVSS v3 score
vulnerability.package.name  - Affected package
vulnerability.package.version - Installed version
vulnerability.status        - active/solved

# Get JWT token
TOKEN=$(curl -su wazuh:wazuh -k -X POST \
  "https://localhost:55000/security/user/authenticate?raw=true")

# Or with custom credentials
TOKEN=$(curl -su myuser:mypass -k -X POST \
  "https://localhost:55000/security/user/authenticate?raw=true")

# All requests use: -H "Authorization: Bearer $TOKEN"
# API config: /var/ossec/api/configuration/api.yaml
# Default port: 55000

<!-- In /var/ossec/etc/ossec.conf -->
<integration>
  <name>slack</name>
  <hook_url>https://hooks.slack.com/services/T00/B00/XXXXXXX</hook_url>
  <!-- Only send alerts level 10+ -->
  <level>10</level>
  <alert_format>json</alert_format>
</integration>

<!-- Scope to specific rule groups -->
<integration>
  <name>slack</name>
  <hook_url>https://hooks.slack.com/services/T00/B00/XXXXXXX</hook_url>
  <group>authentication_failures,web_attack,attack</group>
  <alert_format>json</alert_format>
</integration>

<!-- FIM + VirusTotal: check file hashes on modification -->
<integration>
  <name>virustotal</name>
  <api_key>YOUR_VT_API_KEY</api_key>
  <!-- Must use syscheck group -->
  <group>syscheck</group>
  <alert_format>json</alert_format>
</integration>

<!-- Trigger rule for VT positive result (auto-generated by integration) -->
<!-- Rule 87105: VirusTotal alert - X engines detected the file -->

<global>
  <email_notification>yes</email_notification>
  <email_to>[email protected]</email_to>
  <smtp_server>mail.company.com</smtp_server>
  <email_from>[email protected]</email_from>
  <email_maxperhour>20</email_maxperhour>
  <!-- Granular: send email for specific rules regardless of level -->
  <email_alert_level>12</email_alert_level>
</global>

<!-- Per-rule email override in alert section -->
<email_alerts>
  <email_to>[email protected]</email_to>
  <rule_id>110001,110009</rule_id>
  <do_not_delay />
</email_alerts>

<integration>
  <name>custom-w2thive</name>
  <!-- Path to custom Python script -->
  <hook_url>http://thehive.company.com:9000</hook_url>
  <api_key>YOUR_THEHIVE_API_KEY</api_key>
  <level>10</level>
  <alert_format>json</alert_format>
</integration>

<!-- Custom script at: /var/ossec/integrations/custom-w2thive -->
<!-- chmod 750 /var/ossec/integrations/custom-w2thive -->
<!-- chown root:wazuh /var/ossec/integrations/custom-w2thive -->

<integration>
  <name>pagerduty</name>
  <api_key>PAGERDUTY_ROUTING_KEY</api_key>
  <level>12</level>
  <alert_format>json</alert_format>
</integration>

<!-- /var/ossec/etc/rules/local_rules.xml -->
<group name="tuning,">

  <!-- Lower level of noisy rule (overwrite="yes" replaces built-in) -->
  <rule id="5712" level="3" overwrite="yes">
    <if_sid>5712</if_sid>
    <description>SSH failed login (downgraded - high volume environment)</description>
  </rule>

  <!-- Completely suppress a rule -->
  <rule id="5715" level="0" overwrite="yes">
    <if_sid>5715</if_sid>
    <description>SSH reverse mapping (suppressed)</description>
  </rule>

  <!-- Suppress for specific user -->
  <rule id="100900" level="0">
    <if_sid>5710</if_sid>
    <user>backup-svc</user>
    <description>SSH failure from service account (expected)</description>
  </rule>

  <!-- Suppress for specific IP -->
  <rule id="100901" level="0">
    <if_sid>5710</if_sid>
    <srcip>10.0.0.50</srcip>
    <description>SSH failure from monitoring host (expected)</description>
  </rule>

  <!-- Raise level of specific event for VIP host -->
  <rule id="100902" level="15" overwrite="yes">
    <if_sid>5710</if_sid>
    <hostname>dc01.corp.local</hostname>
    <description>SSH failure on domain controller - elevated priority</description>
  </rule>

</group>

# Create whitelist file
cat > /var/ossec/etc/lists/whitelist-ips << 'EOF'
10.0.0.50:scanner
10.0.0.51:monitoring
192.168.1.100:pentest-approved
EOF

# Create malicious IP list
cat > /var/ossec/etc/lists/malicious-ips << 'EOF'
185.220.101.1:c2
45.33.32.156:scanner
EOF

# Register lists in ossec.conf ruleset block
# <list>etc/lists/whitelist-ips</list>
# <list>etc/lists/malicious-ips</list>

# Rebuild CDB binary index (automatic on manager restart)
# wazuh-analysisd re-reads lists on start/restart
/var/ossec/bin/wazuh-control restart
# Verify list loaded:
grep "lists" /var/ossec/logs/ossec.log | tail -5

<!-- Use whitelist in rule to suppress -->
<rule id="100910" level="0">
  <if_sid>5710,5711,5712</if_sid>
  <list field="srcip" lookup="address_match_key">etc/lists/whitelist-ips</list>
  <description>SSH failure from whitelisted host - suppressed</description>
</rule>

<!-- Use threat intel list to escalate -->
<rule id="100911" level="15">
  <if_group>syslog,firewall,web</if_group>
  <list field="srcip" lookup="address_match_key">etc/lists/malicious-ips</list>
  <description>Traffic from known malicious IP: $(srcip)</description>
  <group>threat_intel,attack,</group>
  <mitre><id>T1071</id></mitre>
</rule>

<global>
  <!-- Ignore repeated alerts from same IP within N seconds -->
  <white_list>10.0.0.50</white_list>
  <white_list>192.168.1.0/24</white_list>
  <!-- Increase log output verbosity -->
  <logall>yes</logall>
  <logall_json>yes</logall_json>
</global>

<!-- Rule ignore (flood prevention) - per-rule attribute -->
<!-- <rule id="100001" level="6" ignore="60"> -->
<!-- ignore="60" means don't re-fire within 60 seconds for same source -->

# Full service control
/var/ossec/bin/wazuh-control start
/var/ossec/bin/wazuh-control stop
/var/ossec/bin/wazuh-control restart
/var/ossec/bin/wazuh-control reload     # reload rules without restart
/var/ossec/bin/wazuh-control status     # show all daemons

# Individual daemon restart
systemctl restart wazuh-manager         # systemd (preferred)
systemctl restart wazuh-indexer
systemctl restart wazuh-dashboard

# Config syntax test before restart
/var/ossec/bin/wazuh-analysisd -t
/var/ossec/bin/wazuh-remoted -t

# Check for config errors
grep -i "error\|warn" /var/ossec/logs/ossec.log | tail -50

# Force agent reconnect
/var/ossec/bin/agent_control -R <agent_id>

# Delete agent
/var/ossec/bin/manage_agents -r <agent_id>
# OR via API:
curl -sk -H "Authorization: Bearer $TOKEN" -X DELETE \
  "https://localhost:55000/agents?agents_list=003&status=disconnected"

# Run FIM scan immediately on agent
/var/ossec/bin/agent_control -a -u <agent_id>

# Check cluster status
/var/ossec/bin/cluster_control -l    # list nodes
/var/ossec/bin/cluster_control -i    # node info

# Verify rule fired (logtest)
echo "Jan 10 12:00:01 myhost sshd[1234]: Failed password for root from 10.0.0.1 port 52020 ssh2" \
  | /var/ossec/bin/wazuh-logtest -v

# Stats
/var/ossec/bin/wazuh-analysisd --diag    # analysis engine diag dump

• Wazuh Documentation
• Wazuh GitHub
• Wazuh Ruleset
• Wazuh API Reference
• Wazuh Blog
• Sysmon Config

• Sigma (Detection rule standard)
• Velociraptor (DFIR and threat hunting)
• MITRE ATT&CK (Framework reference)
• Purple Team Toolkit (Purple team tools overview)
• Forensics Toolkit (Volatility, event IDs, DFIR)
• Linux Opsec (Linux hardening and operations)